# Data Residency > Source: https://ibl.ai/resources/glossary/data-residency > Last updated: 2026-08-19 **Definition:** Data residency is the requirement that data be stored and processed within a specified geographic or legal jurisdiction, and for AI systems it constrains where inference happens — not merely where records are filed at rest. **On ibl.ai you own all the code and the data, run it model-agnostic across any LLM, and pay with no per-seat pricing — so you can deploy anywhere, from your own cloud to a fully air-gapped network.** ## What is Data Residency? The distinction that catches organizations out is between storage and processing. A database pinned to a regional data centre satisfies a naive reading of residency while every prompt containing that data is sent to a model endpoint in another jurisdiction for inference. Residency is also not the same as sovereignty. Data can be resident in-country and still be subject to a foreign government's lawful access if the operating vendor is incorporated under that government's jurisdiction. Residency describes location; sovereignty describes legal and technical control. For AI specifically, the surfaces to check are the model endpoint, the embedding service, the vector store, the logging pipeline and any third-party evaluation or monitoring tooling — each is a potential cross-border transfer. ## Why It Matters Data residency requirements appear in GDPR transfer rules, sector regulation for health and financial data, national localization statutes, and increasingly in enterprise contracts with public-sector customers. For AI they are the constraint that most often forces a self-hosted or regional deployment. ## Key Characteristics ### Processing Location, Not Only Storage Inference is processing. A prompt containing regulated data that is sent to a model endpoint abroad is a cross-border transfer even when the source database never leaves the region. ### Distinct From Sovereignty Data can be physically resident and still reachable under a foreign jurisdiction's lawful-access powers if the operator is incorporated there. Location and legal control are separate properties. ### Every Pipeline Stage Counts Embeddings, vector search, logging, evaluation and monitoring each move data. Residency holds only if every stage stays inside the boundary, not just the primary model call. ### Applies to Derived Data Embeddings and summaries derived from regulated records generally inherit their regulatory character, so a vector index abroad can breach residency even without raw records. ### Verifiable Rather Than Asserted A residency claim that cannot be checked against network behaviour and deployment topology is a contractual assurance, not a control an auditor can test. ### Self-Hosting Resolves It Structurally Running the model and the platform inside your own regional infrastructure makes residency a property of the architecture rather than a clause requiring ongoing verification. ## Examples - **Financial Services Firm:** A European bank stores customer records in an EU data centre but sends prompts containing them to a model endpoint hosted in another region. — *Storage residency is satisfied and processing residency is not, which is the gap an examiner is most likely to find.* - **National Health Service:** A national health provider must keep patient data within its borders under localization law that admits no adequacy mechanism. — *Only a deployment where model weights and inference run on domestically located infrastructure satisfies the statute.* - **Public Sector Agency:** A public-sector customer requires that a supplier's AI features process data in-country as a contractual condition of award. — *The supplier deploys a regional self-hosted instance, since a shared multi-region API could not evidence the requirement.* ## How does ibl.ai satisfy data residency requirements? By making residency a property of where you deploy rather than a clause you have to trust. ibl.ai is the agentic AI platform where you own all the code and the data, so the entire pipeline — model inference, embeddings, vector store, logging and evaluation — runs inside the region and the perimeter you choose. It is model-agnostic, so you can host open-weight models locally where no external call is permitted, and carries no per-seat pricing. You can deploy anywhere: your own regional cloud, your VPC, on-premise, GovCloud, or a fully air-gapped network. Because you hold the source, your auditors can verify the claim rather than accept it. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. ## FAQ **Q: Is data residency the same as data sovereignty?** No. Residency is about physical or jurisdictional location. Sovereignty is about who has legal and technical control. Data can sit in-country on infrastructure operated by a foreign-incorporated vendor and remain subject to that vendor's home jurisdiction. **Q: Do hosted AI APIs satisfy data residency?** Some offer regional endpoints that satisfy many requirements, but you are relying on the provider's configuration and contractual assurance rather than on a topology you control. Where a regulator expects a testable control, that distinction matters. **Q: Do embeddings and vector indexes fall under residency rules?** Generally yes. Data derived from regulated records typically inherits their regulatory character, so an embedding index hosted outside the boundary can breach residency even though it contains no verbatim source text. **Q: Does residency require self-hosting?** Not always, but self-hosting resolves it structurally rather than contractually. When the model and platform run inside your own regional infrastructure, residency follows from the architecture and can be demonstrated to an auditor directly. **Q: What is the most commonly missed residency gap in AI systems?** Logging and evaluation. Teams carefully region-pin the database and the model endpoint, then ship prompts and completions to a third-party observability or evaluation service in another jurisdiction. ## How does ibl.ai approach Data Residency? **ibl.ai is the agentic AI platform where you own all the code and the data. You self-host the entire stack inside your own perimeter, run it model-agnostic across any LLM and switch anytime, and pay by usage with no per-seat pricing — so you can deploy anywhere: your cloud, on-premise, GovCloud, or fully air-gapped.** - **You own all the code and the data.** Full source code under a perpetual license, running on your infrastructure. Not API access to someone else's platform — the stack itself is yours. - **Model-agnostic.** Run any LLM — Claude, GPT, Gemini, Llama, Command, or your own fine-tune — and switch providers without rewriting the platform. - **No per-seat pricing.** Usage-based billing against a budget cap you set. Cost tracks what your organization actually uses, not how many people you employ. - **Deploy anywhere.** Your cloud, your VPC, on-premise, GovCloud, or a fully air-gapped network with no outbound connectivity. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.